The most popular web content management system by far unfortunately also attracts many unloved bots that attack the site and then like to nest so deeply in the system that manual removal is usually impossible. So you should always update WordPress. The official WordPress website also provides regular information on security updates for the WordPress system itself and some plugins.
Unfortunately, many people look at the backend far too rarely and don't even realize that there are important updates. I have also had two customers in recent years whose WordPress sites were successfully attacked. In some cases, they did not respond to my urgent recommendation to update WordPress in good time. Everyone should be aware that such an attack is never personal. In most cases, it is only about creating web space for spam or phishing sites. Many processes can be automated here.
In addition, more and more providers are switching off old PHP versions. Anyone who has ignored the messages about this shutdown from their provider will suddenly no longer have a functioning site. You can find information about the individual WordPress versions and their PHP compatibility on the official WordPress website. The same naturally also applies to the plugins and the theme used (and possibly also the child theme used).
Always make a backup first
Before updating WordPress, you should always make a backup of the WordPress system!
The bigger the version change, the more important the backup. Or: The further forward a number changes in the version, the more important the backup. I always have a development version for some customers. I can then “quickly” test an update without affecting the live site.
An example: The current WordPress version in the screenshot above is 6.7.1. If the system is to be updated to 6.7.2, this can usually be done safely “on the open heart” = in the live system. To be on the safe side, you can of course make a backup at any time before the update. But I usually don't do such an update in a copy of the live site. If the version jump is from 6.7.1 to 6.8.X, I always make a backup. I never update from 6.X to 7.X in the live system.
If there are updates, you can see this in the WordPress backend at the top next to the page title:
Conclusion: With regular WordPress security updates, you can keep your system up to date and protected against attacks as far as possible.
Here’s another tip: The WordFence plugin not only protects your WordPress site from attacks, but it also automatically notifies you when important updates are available for your system.